REMARKS 



The Examiner has objected to the specification because of informalities. Such 
objection is deemed to have been overcome via the amendments made hereinabove. 

The Examiner has rejected Claims 20-40 under 35 U.S.C. 1 12, second paragraph, 
as being indefinite for failing to particularly point out and distinctive claim the subject 
matter which applicant regards as the invention. In particular, while the Examiner attests 
to the clarity of the term "session," he takes issue with "session reconstruction." While 
applicant does not claim the term "session reconstruction," applicant does claim 
"reconstructing the session." Applicant argues that such terminology is sufficiently clear, 
in view of both the teachings of the specification and the plain meaning of 
"reconstructing." Applicant thus argues that the present claim language is sufficiently 
clear and definite. 

Claims 20-40 are further rejected under 35 U.S.C. 103(a) as being unpatentable 
over Chiu et al. (U.S. Patent Number 5,101,402), hereinafter referred to as Chiu, in view 
of Ronen (U.S. Patent Number 5,845,267), hereinafter referred to as Ronen, further in 
view of Maccabee et al. (U.S. Patent Number 6,108,700), hereinafter referred to as 
Maccabee. Applicant respectfully disagrees with such rejection, especially in view of the 
amendments made hereinabove. 

In particular, simply nowhere in the foregoing references is there disclosed, taught 
or suggested "reconstructing the session utilizing the identified application at a plurality 
of collaborating nodes ," (emphasis added) as claimed by applicant. Such feature is 
extremely beneficial when a session that is "distributed" must be reconstructed. As set 
forth on pages 18 and 19 of the originally filed specification, such claimed feature 
overcomes a significant difficulty associated with the prior art. In particular, it permits 
the reconstruction of sessions that are disturbed among different nodes. 
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Further facilitating such objective are the following features which were added to 
the claims hereinabove and are believed to be patentable. 

"a first flow associated with a first application flows through a first one of the 
nodes." (see Claim 41) 

"a second flow associated with the first application flows through a second one of 
the nodes." (see Claim 42) 

"each of the collaborating nodes includes a packet source and a first hierarchical 
network analyzer" (see Claim 43) 

"each of the collaborating nodes further includes a filter coupled between the 
packet source and the first hierarchical network analyzer." (see Claim 44) 

"the first hierarchical network analyzers of each of the nodes feed information to a 
second hierarchical network analyzer." (see Claim 45) 

" the information is used by the second hierarchical network analyzer to 
reconstruct the session utilizing the identified application." (see Claim 46) 

"the information involves packet forwarding." (see Claim 47) 

"the information involves hints and packet forwarding." (see Claim 48) 

"the information involves hints and a summary of packets." (see Claim 49) 

"the nodes each include a router." (see Claim 50) 
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Simply nowhere in the prior art relied upon by the Examiner is there such a 
combination of features and components for fulfilling the foregoing objectives. 

The Examiner continues by rejecting Claims 20-40 under 35 U.S.C. 103(a) as 
being unpatentable over "Rich Data About Customer Usage." Applicant's invention was 
completed in the United States at a date prior to March 15, 1999, the effective date of the 
above reference that was cited by the Examiner. A declaration and evidence of such are 
submitted herewith. In view of such evidence, the foregoing rejection is deemed to have 
been overcome. 

An allowance is respectfully requested. 

In the event a telephone conversation would expedite the prosecution of this 
application, the Examiner may reach the undersigned at (408) 505-5100. The 
Commissioner is hereby authorized to charge any fees that may be due or credit any 
overpayment to Deposit Account No. 50-1351 (Order No. XACTH)i5B). 



P.O. Box 721120 

San Jose, CA 95172-1120 

408-505-5100 
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APPENDIX A 

This application relates to the following group of applications. Each application in the 
group relates to, and incorporates by reference, each other application in the group. The 
invention of each application is assigned to the assignee of this invention. The group of 
applications includes the following. 



Title 

Method and 
Apparatus for 
Session 

Reconstruction 

Method and 
Apparatus for 
[Distributed] Session 
Reconstruction 



First Inventor 

Limor 
Schweitzer 



Limor 
Schweitzer 



Filing Date 

[Herewith] 04/20/00 



[Herewith] 04/20/00 



Serial 
Number 

[Not Yet 
Assigned] 
09/552,818 



[Not Yet 
Assigned] 
09/553.261 



Attorney 

Docket 

Number 

19623-707 



19623-708 
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APPENDIX B 



20. (Amended) A method for policy-based billing for a distributed network session, 
comprising; 

(a) receiving a plurality of packets at a plurality of analyzers; 

(b) aggregating the plurality of packets; 

(c) analyzing the plurality of packets to identify a plurality of flows; 

(d) identifying a session associated with the flows; 

(e) identifying at least one application associated with the session; 

(f) reconstructing the session utilizing the identified application at a plurality of 
collaborating nodes ; 

(g) identifying a user associated with the session; 

(h) determining a policy; and 

(i) billing the user for the session in accordance with the policy. 

21. The method as recited in claim 20, and further comprising filtering the packets for 
removing packets unrelated to the session. 

22. The method as recited in claim 20, and further comprising identifying application 
events associated with the session based on the policy. 

23. The method as recited in claim 22, and further comprising assigning a 
significance to the application events based on the policy. 

24. The method as recited in claim 22, wherein the user is billed for the session 
utilizing the application events in accordance with the policy. 

25. The method as recited in claim 22, and further comprising determining billing 
information for the session using the application events in accordance with the policy. 
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26. The method as recited in claim 25, and further comprising outputting a report 
including the billing information in accordance with the policy. 

27. The method as recited in claim 20, and further comprising restricting tasks of the 
user in accordance with the policy. 

28. The method as recited in claim 27, wherein an amount of bandwidth is restricted 
in accordance with the policy. 

29. The method as recited in claim 20, wherein the policy includes a series of packet 
capture language expressions and output selectors. 

30. (Amended) A computer program product for policy-based billing for a distributed 
network session, comprising: 

(a) computer code for receiving a plurality of packets at a plurality of analyzers; 

(b) computer code for aggregating the plurality of packets; 

(c) computer code for analyzing the plurality of packets to identify a plurality of 
flows; 

(d) computer code for identifying a session associated with the flows; 

(e) computer code for identifying at least one application associated with the session; 

(f) computer code for reconstructing the session utilizing the identified application^ 
a plurality of collaborating nodes ; 

(g) computer code for identifying a user associated with the session; 

(h) computer code for determining a policy; and 

(i) computer code for billing the user for the session in accordance with the policy. 

3 1 . The computer program product as recited in claim 30, and further comprising 
computer code for filtering the packets for removing packets unrelated to the session. 
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32. The computer program product as recited in claim 30, and further comprising 
computer code for identifying application events associated with the session based on the 
policy. 

33. The computer program product as recited in claim 32, and further comprising 
computer code for assigning a significance to the application events based on the policy. 

34. The computer program product as recited in claim 32, wherein the user is billed 
for the session utilizing the application events in accordance with the policy. 

35. The computer program product as recited in claim 32, and further comprising 
computer code for determining billing information for the session using the application 
events in accordance with the policy. 

36. The computer program product as recited in claim 35, and further comprising 
computer code for outputting a report including the billing information in accordance 
with the policy. 

37. The computer program product as recited in claim 30, and further comprising 
computer code for restricting tasks of the user in accordance with the policy. 

38. The computer program product as recited in claim 37, wherein an amount of 
bandwidth is restricted in accordance with the policy. 

39. The computer program product as recited in claim 30, wherein the policy includes 
a series of packet capture language expressions and output selectors. 

40. (Amended) A method for policy-based billing for a distributed network session, 
comprising: 

(a) receiving a plurality of packets at a plurality of analyzers; 

(b) aggregating the plurality of packets; 
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(c) analyzing the plurality of packets to identify at least a first flow; 

(d) identifying a session associated with the first flow; 

(e) identifying additional flows in the plurality of packets associated with the session; 

(f) filtering the packets for removing packets unrelated to the session; 

(g) identifying at least one application associated with the session; 

(h) reconstructing the session utilizing the identified application at a plurality of 
collaborating nodes ; 

(i) identifying a user associated with the session; 
(j) identifying a policy; 

(k) gathering application events associated with the session based on the policy; 

(1) assigning a significance to the application events based on the policy; 

(m) determining billing information for the session using the application events in 

accordance with the policy; 
(n) outputting a report including the billing information in accordance with the 

policy; 

(o) restricting tasks of the user in accordance with the policy; and 
(p) executing actions in response to the application events in accordance with the 
policy. 

41. (Added) The method as recited in claim 20, wherein a first flow associated with a 
first application flows through a first one of the nodes. 

42. (Added) The method as recited in claim 41, wherein a second flow associated 
with the first application flows through a second one of the nodes. 

43. (Added) The method as recited in claim 20, wherein each of the collaborating 
nodes includes a packet source and a first hierarchical network analyzer. 

44. (Added) The method as recited in claim 43, wherein each of the collaborating 
nodes further includes a filter coupled between the packet source and the first hierarchical 
network analyzer. 
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45. (Added) The method as recited in claim 43, wherein the first hierarchical network 
analyzers of each of the nodes feed information to a second hierarchical network 
analyzer. 

46. (Added) The method as recited in claim 45, wherein the information is used by 
the second hierarchical network analyzer to reconstruct the session utilizing the identified 
application. 

47. (Added) The method as recited in claim 45, wherein the information involves 
packet forwarding. 

48. (Added) The method as recited in claim 45, wherein the information involves 
hints and packet forwarding. 

49. (Added) The method as recited in claim 45, wherein the information involves 
hints and a summary of packets. 

50. (Added) The method as recited in claim 20, wherein the nodes each include a 
router. 



Attorney Docket XACTP015B 



-16- 



